Customer Information Potentially Leaked Following NTT Data Vendor Breach

Financial institutions across Japan have announced that personal information belonging to certain corporate bond investors may have been compromised following an unauthorized access incident at an external vendor used by NTT Data. The security breach affected the "Digital Securities Platform," an external service utilized for handling digital perks and applications associated with corporate bonds. NTT Data reported that data within the system may have been exfiltrated on October 30.

Rakuten Securities stated on October 31 that information concerning a total of 362 entries of customers who purchased digital-perk bonds may have been leaked. The affected offerings include the first unsecured corporate bonds issued by Kagome Co., Ltd., the 80th unsecured corporate bonds issued by West Japan Railway Company, and the 135th unsecured corporate bonds issued by Kintetsu Group Holdings Co., Ltd. for purchases exceeding 1 million yen. Rakuten Securities emphasized that its own proprietary systems were not directly targeted or breached.

Other major brokerages have also disclosed potential exposures stemming from the same vendor compromise. SBI Securities and Mitsubishi UFJ Morgan Stanley Securities reported potential leaks of investor data related to the Kintetsu Group Holdings bond issue. According to reports from the Nikkei and Kansai Television, Kintetsu's 135th unsecured corporate bond issue involved approximately 2,678 cases of potential name and purchase amount leaks, including 1,169 customers from SBI Securities and 95 from Mitsubishi UFJ Morgan Stanley Securities. Additionally, West Japan Railway Company reported potential leaks involving name, address, telephone number, date of birth, and email address for two customers.

Despite the breach, the affected securities companies have reassured customers that critical trading credentials were not exposed. According to information provided to the brokerages, login IDs, passwords, and securities account numbers required for trading are not included in the data that may have been leaked. Furthermore, the financial institutions reported that no unauthorized access or fraudulent transactions directly linked to this incident had been confirmed at the time of the announcements.

The breach has raised concerns regarding third-party data handling and the aggregation of investor details. Because the leaked records often pair customer names with specific investment amounts, experts warn that the data could potentially be misused by bad actors attempting targeted financial scams or unauthorized investment solicitations. The third-party software-as-a-service vendor utilized through NTT Data's "STdirectServices" has suspended operations while investigations continue.

Rakuten Securities, NTT Data, and other impacted firms are actively investigating the full scope, exact cause, and complete extent of the potential data exposure in coordination with the third-party vendor. Companies are reaching out directly to customers whose information has been confirmed as affected. In the meantime, financial institutions are strongly advising clients to remain vigilant against suspicious emails, text messages, and phone calls impersonating corporate entities, and to refrain from clicking unfamiliar links or providing personal details.

Investors have been urged to utilize official applications or bookmarked websites to access their accounts rather than following links provided in unsolicited messages. Financial providers continue to monitor the situation closely as investigations proceed, and further disclosures from other impacted companies remain possible as the review of the third-party platform's security logs progresses.